Hello, welcome to the Wednesday, February 9, 2020 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Well, it's patched Tuesday, so we'll start the podcast with a quick summary here, but it wasn't actually that bad compared to prior

patch Tuesdays. 70 vulnerabilities total are being fixed here, but I think that's the first one.

None of the vulnerabilities are rated critical. Also, none of the vulnerabilities have been exploited before and only one was previously disclosed. Now, somewhat of note are four privilege escalation vulnerabilities in the Windows print spooler. Now, these type of vulnerabilities are nothing new, but for one of them, we already have an

extensive write-up, including details as to how to exploit the vulnerability. This vulnerability

is based on an older vulnerability CVE 2020 1048.

That vulnerability really consisted in just pointing a printer to a file, which then would allow anybody to overwrite that file.

Microsoft patched that back in 2020, but since then there have been various bypasses of the original patch, starting with

simple SimLink attacks, but this latest vulnerability is a little bit tricky, but still

sounds not all that difficult to exploit in that a user has to set up a new printer and then essentially set

up a spool directory for the printer and then trick this printer into writing files into

the printer driver directory which then again an attacker could write a dllLL into that directory that is then loaded.

So stitching essentially together a couple of prior vulnerabilities and again ending up with

a privilege escalation.

Like I said, there is a great and very detailed write-up about this.

If you want to do more, it's more complex than that and really hard to cover within the podcast.

Nothing else that really stuck out here among those vulnerabilities.

Also a bunch of chromium vulnerabilities, of course, that had already been patched earlier this month. So given that there isn't really any

emergency here, take the time and hone a little bit your patch management process, maybe go over

some of the prior month's patches, make sure they all got applied properly. And Google is reducing a new virtual machine threat detection service.

This is a preview release at this point and will be a built-in part of the security command center premium.

One of the initial goals they're going for here is to detect crypto coin miners,

...